Use openid-configuration file for OIDC login setup

188
0
01-10-2024 01:30 PM
Status: Open
BillMitchell
New Contributor III

Add a button in the OIDC login setup to read the openid-configuration metadata endpoint.

ArcGIS Enterprise Portal supports OpenIDConnect (OIDC) login from an upstream identity provider; this is a modern standard which is replacing the older SAML authentication.

In the configuration documentation (https://enterprise.arcgis.com/en/portal/latest/administer/windows/openid-connect-logins.htm), it suggests that the user should open the [server]/.well-known/openid-configuration JSON file and extract 6 values from it and put them into the login configuration fields.  This should be automated by having the form pull values from that configuration file directly.  The openid-configuration JSON follows a standard (https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata) designed precisely for this use case, where an application needs to be configured to work with an upstream identity provider.

By adding an input for the openid-configuration endpoint and a button to pull that data, 6 fields could be auto-populated: Provider issuer ID, OAuth 2.0 authorization URL, Token URL, JWKS URL, User profile URL, and Logout URL.  Having this automated would simplify the setup experience for the user and reduce the potential for errors.

Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpointScreenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint